@namostack/plugin-sdk 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/index.js

@@ -21,10 +21,37 @@ z.object({
 	current: PasswordSchema,
 	next: NewPasswordSchema
 });
+/** A one-time token from an emailed link (confirmation, password reset). */
+const EmailTokenSchema = z.string().min(1).max(256);
+z.object({ token: EmailTokenSchema });
+z.object({ email: EmailSchema });
+z.object({
+	token: EmailTokenSchema,
+	password: NewPasswordSchema
+});
+const DisplayNameSchema = z.string().trim().min(1).max(100);
+z.object({ displayName: DisplayNameSchema });
+z.object({ image: z.string().min(1).max(Math.ceil(524288 / 3) * 4).regex(/^[A-Za-z0-9+/]+={0,2}$/, "Image must be base64-encoded") });
+z.object({
+	email: EmailSchema,
+	password: PasswordSchema
+});
+z.object({ token: EmailTokenSchema });
+z.object({
+	token: EmailTokenSchema,
+	password: NewPasswordSchema
+});
+z.object({ password: PasswordSchema });
 const UserSchema = z.object({
 	id: z.string(),
 	email: z.string(),
-	displayName: z.string()
+	displayName: z.string(),
+	/** Confirmed by following the link in the signup email (or a password reset). Installing and publishing need it. */
+	emailVerified: z.boolean(),
+	/** Path on the app's origin, e.g. `/avatars/usr_…/….jpg`. Unset until the user picks a photo. */
+	avatarUrl: z.string().optional(),
+	/** A new address waiting for its confirmation link; `email` stays the login until then. */
+	pendingEmail: z.string().optional()
 });
 z.object({ user: UserSchema });
 const SessionSummarySchema = z.object({
@@ -37,123 +64,40 @@ const SessionSummarySchema = z.object({
 	current: z.boolean()
 });
 z.object({ sessions: z.array(SessionSummarySchema) });
+z.object({ 
+/** `usr_<uuid>`, as auth-api generates them: nothing else reaches the handlers. */
+userId: z.string().regex(/^usr_[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/) });
+z.object({ developerName: DisplayNameSchema });
 z.object({ token: z.string().min(1) });
+/**
+* Whether the user has confirmed their email, as of this request. Missing counts as `false`, so a
+* token from before the claim existed (mid-deploy) can't pass the `requiresVerifiedEmail` routes.
+*/
+const EmailVerifiedClaimSchema = z.boolean().default(false);
+/** The user as of this request, for responses that show it (`GET /bootstrap`). Missing in a token from before the claims existed (mid-deploy). */
+const ProfileClaimsSchema = {
+	email: z.string().optional(),
+	displayName: z.string().optional(),
+	avatarUrl: z.string().optional(),
+	pendingEmail: z.string().optional()
+};
 /** A request authenticated by the session cookie (the web app). */
 const SessionIdentitySchema = z.object({
 	kind: z.literal("session"),
 	userId: z.string(),
-	sessionId: z.string()
+	sessionId: z.string(),
+	emailVerified: EmailVerifiedClaimSchema,
+	...ProfileClaimsSchema
 });
 /** A request authenticated by a CLI access token (`Authorization: Bearer nst_pat_…`). */
 const CliTokenIdentitySchema = z.object({
 	kind: z.literal("cliToken"),
 	userId: z.string(),
-	tokenId: z.string()
+	tokenId: z.string(),
+	emailVerified: EmailVerifiedClaimSchema,
+	...ProfileClaimsSchema
 });
 z.discriminatedUnion("kind", [SessionIdentitySchema, CliTokenIdentitySchema]);
-const BridgeErrorCodeSchema = z.enum([
-	"permission_denied",
-	"not_found",
-	"validation_error",
-	"quota_exceeded",
-	"timeout",
-	"upgrade_required",
-	"internal"
-]);
-/** How a failed call crosses the bridge; `message` is safe to show. */
-const BridgeErrorBodySchema = z.object({
-	code: BridgeErrorCodeSchema.catch("internal"),
-	message: z.string()
-});
-z.object({ sdkVersion: z.string().min(1) });
-function bridgeResultSchema(value) {
-	return z.discriminatedUnion("ok", [z.object({
-		ok: z.literal(true),
-		value
-	}), z.object({
-		ok: z.literal(false),
-		error: BridgeErrorBodySchema
-	})]);
-}
-/** Enough for a plugin using seedui: its `ThemeProvider` builds the rest from the mode. */
-const PluginThemeSchema = z.object({ mode: z.enum(["light", "dark"]) });
-/** What the plugin learns about itself and the app once connected. */
-const BridgeContextSchema = z.object({
-	/** In live testing (`env: 'dev'`), the slug: the plugin may not be published yet. */
-	pluginId: z.string(),
-	slug: z.string(),
-	/** `dev` while live testing with `namostack dev`: its data is kept apart from real data. */
-	env: z.enum(["prod", "dev"]),
-	name: z.string(),
-	version: z.string(),
-	theme: PluginThemeSchema,
-	/** The browser's language, e.g. `en-US`. */
-	locale: z.string()
-});
-/** `user.getProfile()`: never the email. */
-const PluginUserProfileSchema = z.object({ displayName: z.string() });
-const PluginNotificationSchema = z.object({
-	message: z.string().trim().min(1).max(300),
-	tone: z.enum([
-		"info",
-		"success",
-		"warning",
-		"error"
-	]).default("info")
-});
-/** `ui.resize(height)`, in CSS pixels. */
-const FrameHeightSchema = z.number().int().min(0).max(1e5);
-const DocumentIdSchema = z.string().min(1);
-//#endregion
-//#region ../../types/src/cli.ts
-/** Shown in Settings → Developer; the CLI suggests its hostname, the user confirms it when approving. */
-const TokenNameSchema = z.string().trim().min(1).max(100);
-/** `WDJB-MJHT`: what the user checks in the browser against what the CLI printed. */
-const UserCodeSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{4}-[A-Z]{4}$/, "Invalid code");
-z.object({ tokenName: TokenNameSchema });
-z.object({
-	/** Secret the CLI polls with; never shown to the user. */
-	deviceCode: z.string(),
-	userCode: z.string(),
-	/** The web app's approval page for this login. */
-	verifyUrl: z.string().url(),
-	/** Seconds to wait between polls. */
-	interval: z.number().int(),
-	/** Seconds before the login request expires. */
-	expiresIn: z.number().int()
-});
-z.object({ deviceCode: z.string().min(1) });
-z.discriminatedUnion("status", [
-	z.object({ status: z.literal("pending") }),
-	z.object({
-		status: z.literal("approved"),
-		/** `nst_pat_…`: the CLI stores it, the server only keeps its hash. */
-		token: z.string(),
-		expiresAt: TimestampSchema
-	}),
-	z.object({ status: z.literal("denied") }),
-	z.object({ status: z.literal("expired") })
-]);
-z.object({ userCode: UserCodeSchema });
-z.object({
-	userCode: z.string(),
-	tokenName: z.string()
-});
-z.object({
-	userCode: UserCodeSchema,
-	tokenName: TokenNameSchema
-});
-/** A CLI access token as Settings → Developer lists it; never the token itself. */
-const CliTokenSummarySchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	/** Absent until the CLI first uses the token. */
-	lastUsedAt: TimestampSchema.optional(),
-	expiresAt: TimestampSchema
-});
-z.object({ tokens: z.array(CliTokenSummarySchema) });
-z.object({ tokenId: z.string().min(1) });
-z.object({ token: z.string().min(1) });
 //#endregion
 //#region ../../types/src/plugins.ts
 /** `public`: in the catalog. `unlisted`: installable by direct link. `private`: owner only. */
@@ -304,13 +248,139 @@ const DevSessionSchema = z.object({
 	startedAt: TimestampSchema
 });
 z.object({ devSessions: z.array(DevSessionSchema) });
+//#endregion
+//#region ../../types/src/preferences.ts
+/** `system` follows the OS setting (`prefers-color-scheme`). */
+const ThemePreferenceSchema = z.enum([
+	"light",
+	"dark",
+	"system"
+]);
+/** `GET /preferences` answers it, `PUT /preferences` replaces it whole. */
+const PreferencesSchema = z.object({
+	theme: ThemePreferenceSchema,
+	sidebarCollapsed: z.boolean(),
+	/** Applies plugin updates on its own, except those adding permissions. */
+	autoUpdatePlugins: z.boolean()
+});
+z.object({
+	user: UserSchema,
+	preferences: PreferencesSchema,
+	installedPlugins: z.array(InstalledPluginSchema),
+	devSessions: z.array(DevSessionSchema)
+});
+const BridgeErrorCodeSchema = z.enum([
+	"permission_denied",
+	"not_found",
+	"validation_error",
+	"quota_exceeded",
+	"timeout",
+	"upgrade_required",
+	"internal"
+]);
+/** How a failed call crosses the bridge; `message` is safe to show. */
+const BridgeErrorBodySchema = z.object({
+	code: BridgeErrorCodeSchema.catch("internal"),
+	message: z.string()
+});
+z.object({ sdkVersion: z.string().min(1) });
+function bridgeResultSchema(value) {
+	return z.discriminatedUnion("ok", [z.object({
+		ok: z.literal(true),
+		value
+	}), z.object({
+		ok: z.literal(false),
+		error: BridgeErrorBodySchema
+	})]);
+}
+/** Enough for a plugin using seedui: its `ThemeProvider` builds the rest from the mode. */
+const PluginThemeSchema = z.object({ mode: z.enum(["light", "dark"]) });
+/** What the plugin learns about itself and the app once connected. */
+const BridgeContextSchema = z.object({
+	/** In live testing (`env: 'dev'`), the slug: the plugin may not be published yet. */
+	pluginId: z.string(),
+	slug: z.string(),
+	/** `dev` while live testing with `namostack dev`: its data is kept apart from real data. */
+	env: z.enum(["prod", "dev"]),
+	name: z.string(),
+	version: z.string(),
+	theme: PluginThemeSchema,
+	/** The browser's language, e.g. `en-US`. */
+	locale: z.string()
+});
+/** `user.getProfile()`: never the email. */
+const PluginUserProfileSchema = z.object({ displayName: z.string() });
+const PluginNotificationSchema = z.object({
+	message: z.string().trim().min(1).max(300),
+	tone: z.enum([
+		"info",
+		"success",
+		"warning",
+		"error"
+	]).default("info")
+});
+/** `ui.resize(height)`, in CSS pixels. */
+const FrameHeightSchema = z.number().int().min(0).max(1e5);
+const DocumentIdSchema = z.string().min(1);
+//#endregion
+//#region ../../types/src/cli.ts
+/** Shown in Settings → Developer; the CLI suggests its hostname, the user confirms it when approving. */
+const TokenNameSchema = z.string().trim().min(1).max(100);
+/** `WDJB-MJHT`: what the user checks in the browser against what the CLI printed. */
+const UserCodeSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{4}-[A-Z]{4}$/, "Invalid code");
+z.object({ tokenName: TokenNameSchema });
+z.object({
+	/** Secret the CLI polls with; never shown to the user. */
+	deviceCode: z.string(),
+	userCode: z.string(),
+	/** The web app's approval page for this login. */
+	verifyUrl: z.string().url(),
+	/** Seconds to wait between polls. */
+	interval: z.number().int(),
+	/** Seconds before the login request expires. */
+	expiresIn: z.number().int()
+});
+z.object({ deviceCode: z.string().min(1) });
+z.discriminatedUnion("status", [
+	z.object({ status: z.literal("pending") }),
+	z.object({
+		status: z.literal("approved"),
+		/** `nst_pat_…`: the CLI stores it, the server only keeps its hash. */
+		token: z.string(),
+		expiresAt: TimestampSchema
+	}),
+	z.object({ status: z.literal("denied") }),
+	z.object({ status: z.literal("expired") })
+]);
+z.object({ userCode: UserCodeSchema });
+z.object({
+	userCode: z.string(),
+	tokenName: z.string()
+});
+z.object({
+	userCode: UserCodeSchema,
+	tokenName: TokenNameSchema
+});
+/** A CLI access token as Settings → Developer lists it; never the token itself. */
+const CliTokenSummarySchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	/** Absent until the CLI first uses the token. */
+	lastUsedAt: TimestampSchema.optional(),
+	expiresAt: TimestampSchema
+});
+z.object({ tokens: z.array(CliTokenSummarySchema) });
+z.object({ tokenId: z.string().min(1) });
+z.object({ token: z.string().min(1) });
 const ErrorCodeSchema = z.enum([
 	"unauthenticated",
 	"invalid_credentials",
 	"permission_denied",
 	"not_found",
 	"email_unavailable",
+	"email_unverified",
 	"already_installed",
+	"published_plugins",
 	"slug_taken",
 	"rate_limited",
 	"quota_exceeded",
@@ -319,7 +389,7 @@ const ErrorCodeSchema = z.enum([
 	"internal"
 ]);
 z.object({
-	code: ErrorCodeSchema.catch("internal"),
+	code: z.string().pipe(ErrorCodeSchema.catch("internal")),
 	message: z.string()
 });
 //#endregion
@@ -377,20 +447,6 @@ const FindResponseSchema = z.object({
 	cursor: z.string().optional()
 });
 //#endregion
-//#region ../../types/src/preferences.ts
-/** `system` follows the OS setting (`prefers-color-scheme`). */
-const ThemePreferenceSchema = z.enum([
-	"light",
-	"dark",
-	"system"
-]);
-z.object({
-	theme: ThemePreferenceSchema,
-	sidebarCollapsed: z.boolean(),
-	/** Applies plugin updates on its own, except those adding permissions. */
-	autoUpdatePlugins: z.boolean()
-});
-//#endregion
 //#region src/config.ts
 const SECOND_MS = 1e3;
 /** Every rule the SDK runs on. Durations are in milliseconds. */
@@ -420,7 +476,7 @@ var BridgeError = class extends Error {
 //#endregion
 //#region src/version.ts
 /** Sent to the app when connecting, so it can turn away SDKs too old to work with it. */
-const SDK_VERSION = "0.1.0-rc.1";
+const SDK_VERSION = "0.1.0-rc.2";
 //#endregion
 //#region src/connect.ts
 const NullSchema = z.null();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namostack/plugin-sdk",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-rc.2",
   "description": "Build plugins for namostack: talk to the app, store data, follow its theme.",
   "license": "MIT",
   "homepage": "https://docs.namostack.com",